{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Lateral movement and credential extraction on backup infrastructure are precursors to environment-wide ransomware deployment. Identifying these pivots on critical servers provides the highest-value containment opportunity." }, "name": "Identity-Based Lateral Movement and Credential Access", "type": "investigation", "labels": [ "hunt", "attack.t1021.001", "attack.t1021.002", "attack.t1059.001", "attack.t1003.006", "attack.t1484.002", "attack.t1570" ], "series": { "slug": "blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs", "index": 2, "title": "Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs", "total": 3 }, "related": [ { "hunt": "discovery-internal-reconnaissance", "reason": "Internal reconnaissance using Grixba and NetScan is handled in a separate hunt focused on discovery artifacts.", "relation": "out-of-scope-alternative" }, { "hunt": "earthtime-trojan-ransomware-recon", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "This hunt pivots between sign-in anomalies and behavioural script content. A single rule firing on a logon is too noisy, and a rule on script keywords misses the context of which account performed the action; the hunt weighs the sequence across three surfaces to confirm an intrusion.", "coverage": [ { "stage": "credential-access-and-privilege-escalation", "steps": [ "credential-harvesting-scripts", "lateral-tool-execution" ], "status": "covered" }, { "stage": "lateral-movement", "steps": [ "anomalous-admin-logons", "lateral-tool-execution" ], "status": "covered" }, { "stage": "initial-access-trojanized-installer", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "execution-sectoprat-injection", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "persistence-mechanisms", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "discovery-internal-reconnaissance", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "collection-and-exfiltration", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "command-and-control", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "defense-evasion", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Trojanized EarthTime Installer", "slug": "initial-access-trojanized-installer", "tactic": "initial-access", "techniques": [ "T1204.002", "T1036.005" ], "observables": [ "EarthTime.exe from Downloads folder", "Brave Pragmatic Network Technology Co., Ltd. revoked certificate", "GlobalSign GCC R45 EV CodeSigning CA 2020" ] }, { "name": "SectopRAT Injection and C2 Fetch", "slug": "execution-sectoprat-injection", "tactic": "execution", "techniques": [ "T1059.003", "T1127.001", "T1055" ], "observables": [ "EarthTime.exe spawning cmd.exe spawning MSBuild.exe with no arguments", "Process injection into MSBuild.exe", "Pastebin connection for C2 configuration" ] }, { "name": "Startup Shortcut and Local Account Creation", "slug": "persistence-mechanisms", "tactic": "persistence", "techniques": [ "T1547.001", "T1136.001" ], "observables": [ "Shortcut (.lnk) created in %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", "Creation of a new local account with administrative privileges" ] }, { "name": "DCSync and Veeam Credential Harvesting", "slug": "credential-access-and-privilege-escalation", "tactic": "credential-access", "techniques": [ "T1484.002", "T1003.006", "T1059.001" ], "observables": [ "DCSync attack against Domain Controller", "PowerShell script executed on backup server to retrieve Veeam credentials" ] }, { "name": "Internal Discovery Tool Deployment", "slug": "discovery-internal-reconnaissance", "tactic": "discovery", "techniques": [ "T1087", "T1482", "T1018", "T1046" ], "observables": [ "AdFind.exe", "SharpHound.exe", "netscan.exe (SoftPerfect)", "GT_NET.exe (Grixba)", "ipconfig", "nltest" ] }, { "name": "Lateral Movement via RDP and PsExec", "slug": "lateral-movement", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1570", "T1021.002" ], "observables": [ "RDP connections (port 3389) using created local account and built-in Administrator", "PsExec used to execute SystemBC on remote hosts", "wmiexec used for remote reconnaissance commands" ] }, { "name": "WinRAR Staging and WinSCP Exfiltration", "slug": "collection-and-exfiltration", "tactic": "exfiltration", "techniques": [ "T1560.001", "T1048.003" ], "observables": [ "WinRAR archiving file shares", "WinSCP transferring archives to cloud host via unencrypted FTP" ] }, { "name": "SystemBC and Betruger C2 Infrastructure", "slug": "command-and-control", "tactic": "command-and-control", "techniques": [ "T1090.003", "T1105" ], "observables": [ "WakeWordEngine.dll or conhost.dll (SystemBC) in C:\\Users\\Public\\Music\\", "rundll32.exe calling exported Reset function", "Betruger backdoor deployment", "C2 IPs: 45.141.87.55 (9000, 15647) and 149.28.101.219 (443)" ] }, { "name": "Security Tampering and Masquerading", "slug": "defense-evasion", "tactic": "defense-evasion", "techniques": [ "T1562.001", "T1027", "T1036" ], "observables": [ "Disabling Microsoft Defender protections", "Binaries with spoofed metadata (SentinelOne, Avast)", "Timestomping activities", "Use of C:\\Users\\Public\\Music\\ as staging directory" ] } ], "summary": "An affiliate threat actor likely linked to multiple ransomware groups used a trojanized version of the EarthTime application to deploy SectopRAT and SystemBC. They performed extensive internal discovery with tools like AdFind and Grixba, moved laterally via RDP and PsExec, and ultimately archived and exfiltrated sensitive data via WinSCP over clear-text FTP." }, "severity": "high", "rationale": "Focus the hunt on critical systems including domain controllers, backup servers, and file servers. The first query filters specifically for these high-value targets to reduce noise from common user logons.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has moved laterally to high-value infrastructure like domain controllers and backup servers using hijacked accounts or newly created local admins, then executed scripts to harvest credentials.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts from the scoping step to focus the fan-out." }, "lateral_tools": { "type": "list[string]", "default": [ "psexec.exe", "psexesvc.exe", "wmiexec.exe", "wmiexec.vbs", "grixba.exe", "netscan.exe" ], "description": "Common lateral movement tool filenames." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "critical_servers": { "type": "list[host]", "default": [ "dc01", "dc02", "backup", "veeam", "filesrv" ], "description": "Hostnames or substrings for Domain Controllers and Backup servers." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/", "name": "The DFIR Report \u2014 Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs" } ], "blind_spots": [ { "id": "no-identity-visibility", "risk": "Legitimate automated administrative tasks might be confused with lateral movement if logon types are not granular.", "stage": "lateral-movement", "question": "whether an RDP session used a saved credential or an interactive login", "requires": "hb_auth_signin with full logon type support" }, { "id": "script-block-logging", "risk": "Attackers can hide credential-harvesting logic inside complex, in-memory script blocks that bypass simple process command-line detection.", "stage": "credential-access-and-privilege-escalation", "question": "the exact script content when scripts are obfuscated or executed in memory", "requires": "Full PowerShell Script Block Logging (Event ID 4104)" } ] }, "name": "Identity-Based Lateral Movement and Credential Access", "description": "This hunt targets the middle and late stages of an intrusion where attackers pivot across the identity plane. It identifies anomalous RDP logons to critical servers followed by the execution of specialized scripts for Veeam credential extraction or Active Directory replication. The hunt uses a funnel flow: scoping for unusual administrative logins, then fanning out to examine the command lines and script text that confirm credential harvesting and lateral pivoting." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs", "index": 2, "title": "Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs", "total": 3 }, "coverage": [ { "stage": "credential-access-and-privilege-escalation", "steps": [ "credential-harvesting-scripts", "lateral-tool-execution" ], "status": "covered" }, { "stage": "lateral-movement", "steps": [ "anomalous-admin-logons", "lateral-tool-execution" ], "status": "covered" }, { "stage": "initial-access-trojanized-installer", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "execution-sectoprat-injection", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "persistence-mechanisms", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "discovery-internal-reconnaissance", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "collection-and-exfiltration", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "command-and-control", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "defense-evasion", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" } ], "rationale": "An intruder has moved laterally to high-value infrastructure like domain controllers and backup servers using hijacked accounts or newly created local admins, then executed scripts to harvest credentials.", "blind_spots": [ { "id": "no-identity-visibility", "risk": "Legitimate automated administrative tasks might be confused with lateral movement if logon types are not granular.", "stage": "lateral-movement", "question": "whether an RDP session used a saved credential or an interactive login", "requires": "hb_auth_signin with full logon type support" }, { "id": "script-block-logging", "risk": "Attackers can hide credential-harvesting logic inside complex, in-memory script blocks that bypass simple process command-line detection.", "stage": "credential-access-and-privilege-escalation", "question": "the exact script content when scripts are obfuscated or executed in memory", "requires": "Full PowerShell Script Block Logging (Event ID 4104)" } ], "scoping_notes": "Focus the hunt on critical systems including domain controllers, backup servers, and file servers. The first query filters specifically for these high-value targets to reduce noise from common user logons.", "beyond_detection": "This hunt pivots between sign-in anomalies and behavioural script content. A single rule firing on a logon is too noisy, and a rule on script keywords misses the context of which account performed the action; the hunt weighs the sequence across three surfaces to confirm an intrusion." } }, { "id": "anomalous-admin-logons", "type": "query", "label": "Anomalous Administrative Logons", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT dst_endpoint_name, src_endpoint_ip, actor_user_name, COUNT(*) AS logon_count, MIN(time) AS first_logon FROM hb_auth_signin WHERE status_id = 1 AND instr(',' || '{{critical_servers}}' || ',', ',' || LOWER(dst_endpoint_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_name, src_endpoint_ip, actor_user_name HAVING logon_count < 10 ORDER BY logon_count ASC", "surface": "hb_auth_signin", "description": "Identify successful logins to critical servers from source IPs or users that are rare for those hosts.", "expected_signal": "A list of critical hosts and users logging in from unusual sources. Silence indicates no infrequent logins were recorded to these systems." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Anomalous Administrative Logons", "reads": [ "dst_endpoint_name", "src_endpoint_ip", "actor_user_name", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT dst_endpoint_name, src_endpoint_ip, actor_user_name, COUNT(*) AS logon_count, MIN(time) AS first_logon FROM hb_auth_signin WHERE status_id = 1 AND instr(',' || '{{critical_servers}}' || ',', ',' || LOWER(dst_endpoint_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_name, src_endpoint_ip, actor_user_name HAVING logon_count < 10 ORDER BY logon_count ASC", "silence": "not_evidence_of_absence", "expected": "A list of critical hosts and users logging in from unusual sources. Silence indicates no infrequent logins were recorded to these systems.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "credential-harvesting-scripts", "type": "query", "label": "Credential Harvesting Script Content", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, actor_user_name, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%veeam%' OR LOWER(script_content) LIKE '%reg save %sam%' OR LOWER(script_content) LIKE '%sekurlsa%' OR LOWER(script_content) LIKE '%dpapi%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Search for executed script blocks that target backup software secrets or local account databases.", "expected_signal": "Script blocks containing keywords associated with credential extraction tools or techniques. Silence suggests no such scripts ran on the scoped hosts." }, "parents": [ { "id": "anomalous-admin-logons" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Credential Harvesting Script Content", "reads": [ "device_hostname", "actor_user_name", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_user_name, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%veeam%' OR LOWER(script_content) LIKE '%reg save %sam%' OR LOWER(script_content) LIKE '%sekurlsa%' OR LOWER(script_content) LIKE '%dpapi%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script blocks containing keywords associated with credential extraction tools or techniques. Silence suggests no such scripts ran on the scoped hosts.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "lateral-tool-execution", "type": "query", "label": "Lateral Movement Tool Execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{lateral_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%net user % /add%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the execution of remote administration tools or behavioral markers like local admin account creation.", "expected_signal": "Process command lines for tool execution or local user creation. Silence indicates no matching tool signatures were observed." }, "parents": [ { "id": "anomalous-admin-logons" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Lateral Movement Tool Execution", "reads": [ "device_hostname", "user_name", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{lateral_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%net user % /add%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Process command lines for tool execution or local user creation. Silence indicates no matching tool signatures were observed.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "triage-identity-pivot", "type": "analytic", "label": "Triage Identity Pivot Evidence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "anomalous-admin-logons", "credential-harvesting-scripts", "lateral-tool-execution" ], "objective": "Determine if any host shows an anomalous administrative login followed by credential extraction or lateral tool usage.", "description": "Assess whether the logon events, script executions, and tool markers indicate a coordinated lateral movement chain.", "max_iterations": 5, "expected_signal": "A per-host verdict linking an unusual logon to malicious follow-on activity.", "success_criteria": "A verdict of malicious | suspicious | benign per host with citations of the specific rows." }, "parents": [ { "id": "credential-harvesting-scripts", "kind": "merge" }, { "id": "lateral-tool-execution", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route Based on Triage", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one critical server", "condition": "the triage verdict is malicious for at least one critical server", "blind_spot": "no-identity-visibility", "confidence": "high", "description": "Direct the hunt toward containment or analyst review based on the triage findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-identity-pivot" } ] }, { "id": "isolate-pivot-host", "type": "action", "label": "Isolate Pivot Host", "config": { "target": "endpoint", "description": "Contain the threat by isolating the host where malicious lateral movement was confirmed.", "instructions": "Isolate the compromised host and initiate an emergency password reset for any administrative accounts involved in the suspicious logons.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "audit-identity-changes", "type": "task", "label": "Audit Identity Changes", "config": { "assignee": "analyst", "description": "Manually verify whether the attacker created new local accounts or modified group memberships.", "instructions": "Review the local administrators group and newly created user accounts on the identified servers. Verify the source IPs of RDP connections in the security event logs to confirm they originate from unauthorized locations." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-pivot-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close-out Hunt", "config": { "assignee": "analyst", "description": "Finalize documentation and record any visibility gaps encountered during the hunt.", "instructions": "Record the timeline of lateral movement. Document any missing telemetry such as truncated script blocks or lack of auth protocol details." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "audit-identity-changes" } ] } ] }